Plenty of people won't enter a card number on a hotel's checkout page, then hand the same card to a server who walks it out of sight for several minutes. The online form is encrypted and the card is protected by law. The handoff is neither. The short version: federal law makes the card issuer carry most of the loss from an unauthorized credit card charge, so fraud worry is usually pointed at the wrong target.
The takeaway: your attention belongs on identity theft and account takeover, not on individual unauthorized charges.
The Legal Protection
For credit cards, federal law limits your liability for unauthorized charges to $50. If you report the card before anyone uses it, you owe nothing. Many issuers go further with zero-liability policies, so check your card agreement for the exact terms.
Compare the alternatives:
- Cash: once it's stolen, it's gone.
- Debit cards: your liability depends on how fast you report. Report before any unauthorized charges and it's $0. Report within two business days of learning of the loss and it's up to $50. After that, up to $500 if you report within 60 days of the statement being sent, and after 60 days you can lose everything taken from the account and possibly more.
- Credit cards: the disputed charge is the bank's problem, not a hole in your checking account.
Disputes have their own rules. Under the Fair Credit Billing Act, your written dispute has to reach the issuer within 60 days of the first bill that shows the error. The issuer must acknowledge it within 30 days and resolve it within 90 days of receiving it. Don't wait until month end to look; the 60-day clock starts with the statement, not with the day you notice.
Where Fraud Fear Is Miscalibrated
Large breaches at retailers, hotel chains and credit bureaus have exposed card and personal data for tens of millions of people. If you've used a card for years, assume some of your data is already out there. That makes one more purchase at a reputable merchant a small added risk, and it makes refusing to shop online a poor way to spend your caution.
The costliest version of the mistake is treating a debit card as the safe choice. A debit card pulls money from your own account, so a fraud event ties up your cash while it's sorted out. A credit card puts the issuer's money at risk instead.
The Threats Worth Your Attention
Identity theft is the real harm. Someone using your Social Security number and date of birth to open accounts in your name can take months to undo. A credit freeze is the strongest step you can take. It's free, and you place it separately with each of the three bureaus: Equifax, Experian and TransUnion. A freeze can also be lifted temporarily when you apply for credit, and the bureaus must act within one hour on a phone or online request.
Account takeover is the second. A thief who gets into your online card account doesn't need the physical card. They can change your contact details, order a replacement card or redeem points. The defenses are the ones you'd use on any valuable account: a long unique password in a password manager such as 1Password, multifactor authentication wherever it's offered, and a quick look at your registered devices and contact details now and then. Treat any unsolicited "verify your account" call or text as hostile until proven otherwise.
The Cost That Is Real
The real cost of card fraud is friction. You work off a backup card for the rest of a trip, and you update autopay merchants one by one when the replacement arrives. That's why redundancy helps: carry cards from two different issuers, ideally on both Visa and Mastercard networks, and use a virtual card number for online merchants you don't know if your issuer offers them in its app. Our guide to carrying a backup credit card when you travel covers what to do if a card is lost, stolen or declined.
Why the Fear Misfires
Two well-known biases explain most of the mismatch. The availability heuristic, described by Tversky and Kahneman, says we judge how likely something is by how easily examples come to mind, and breach headlines are vivid. A sense of control does the rest: typing a number into a form feels like a choice, so it feels riskier than handing over a card, which feels like routine. Losses also weigh more than equal gains in our heads, so an imagined fraud charge can outweigh a real welcome bonus.
A Calibrated Approach
Do this:
- Turn on transaction alerts in every issuer app.
- Read your statements once a month.
- Freeze your credit at all three bureaus if you haven't.
- Use a password manager and multifactor authentication on every financial account.
- Keep two unrelated payment methods.
- Dispute anything odd as soon as you see it, inside the 60-day window.
Skip this:
- Avoiding credit cards at reputable online merchants.
- Carrying only debit cards because they feel safer.
- Avoiding rewards cards because of fraud stories.
- Keeping a "safe" card for online use and a "real" card for stores, since the legal protection is the same.
When Caution Earns Its Keep
Caution that leads to alerts, statement checks and backup cards is doing useful work. Caution that pushes you to debit cards, cash or no rewards at all costs you real value over time. Cards like the Chase Sapphire Preferred earn rewards on everyday spending, and skipping them out of fraud worry gives up that value while adding exposure on the debit side.
Bottom Line
Credit cards give you the strongest fraud protection of any payment method you carry. Your liability is capped at $50, the dispute process is set by law, and the real defenses are a credit freeze and strong logins. Take the small friction of a replacement card in exchange for the protection and the rewards.
Updated October 19, 2026: added a link to our backup card guide.
